CVE-2026-39827

Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

Medium · published May 22, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Published
2026-05-22T02:31Z
EPSS history
Timeline
  • 22 MAY 02:31Z
    Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh
    cvelistv5